Bitcoin BTC$83.292,12 fell to $83,000 on Monday, down 1.7% since midnight UTC and 2.1% over 24 hours, though it is the altcoin market taking the brunt of the damage, with 91 of the 100 CoinDesk 100 constituents lower on the day and the index down 2.6% to 1,874.56.

The unwind is almost a mirror image of Friday, with quant (QNT) falling 16% since midnight after rising 39% over 24 hours in Friday’s session, indexing protocol token the graph GRT$0.03188 is down 12% having gained 14%, and tokenization token ondo ONDO$0.5203 is 12% lower. The sector indices that led the advance are leading the retreat, with the DeFi Select Index (DFX) down 6.4% and 7.3% over 24 hours while the CoinDesk Computing Index (CPUS) lost 3.2% and 5.0%.

The trigger sits in oil rather than in crypto, with President Donald Trump rejecting Iran’s latest terms for reopening the Strait of Hormuz, conditions that included the release of frozen Iranian funds, the lifting of oil sanctions and an end to the U.S. naval blockade of Iranian ports. Brent crude has climbed back above $100 to $100.83, up 3.2% on the day, reversing Friday’s move below that level.

Digital asset-friendly financial institution Franklin Templeton is expanding its “off-exchange collateral program” to Bybit, allowing the exchange’s users to use shares in Franklin Templeton’s tokenized money market funds for crypto trading.

The partnership allows investors and wallet holders on the exchange to pledge shares, which represent about $686 million in net assets, as collateral to borrow stablecoins USDT or USDC while earning yield on the underlying assets, according to a press release on Monday.

The key point is that users will not have to move the underlying assets to Bybit. Instead, regulated custody platform ByCustody will hold the underlying assets off-exchange, with the value mirrored in Bybit’s trading environment to enable yield generation while unlocking trading liquidity, the release said.

This is not Franklin Templeton’s first off-exchange collateral partnership; the firm also offers its tokenized money market funds to customers of Binance and OKX. The work continues the buildout of collateral mirroring in the crypto space and the opportunities that brings, said Sandy Kaul, Head of Digital Assets and Innovation at Franklin Templeton.

LayerZero blamed Kelp for using one verifier instead of several, while Kelp said LayerZero staff had reviewed its setup and never objected. CoinGecko data showed nearly half of active LayerZero apps used the same one-verifier arrangement, and Kelp said it would move rsETH to Chainlink.

CCIP 2.0 offers a similar menu of verifiers, which lets companies run their own or hire outside providers such as Infosys and Nethermind. Chainlink’s own network of 16 independent node operators still checks every transfer, regardless of what else a user adds.

Users shouldn’t have to be “cross-chain security infrastructure experts,” the company told CoinDesk.

“Historically, legacy bridges have lost billions due to insecure infrastructure, while in-house builds are slow and expensive,” Johann Eid, Chainlink Labs’ chief business officer, said in a statement.

The upgrade also changes a safeguard Chainlink used to promote heavily; its Risk Management Network, a separate set of nodes that double-checked transactions, no longer plays that role. Chainlink said that kind of independent check can now come from the optional verifiers instead, which suggests a user who adds nothing now relies on one verifier network, where previously there were two.

Existing Chainlink users were automatically moved to the new version. Still, the company has not named any institution using the new verifiers yet, saying only that Aave and Maple have started adopting some of the upgrade’s other features.

“If every household used AI agents to optimize the return on their cash balances, banks could lose a large share of the cheap deposits they rely on to make loans, which would be a problem for the entire financial system,” he noted.

Agentic finance refers to AI that acts rather than just answers. These agents can monitor balances in real time, compare returns across institutions, move idle cash into higher-yield accounts and move it back in time for bills.

Estimates of the market’s size vary widely. Mordor Intelligence puts agentic AI in financial services at $7.78 billion in 2026 and projects $43.52 billion by 2031. MarketsandMarkets sizes the narrower AI agents segment at about $845 million in 2025.

Crypto is already building the payment rails these agents would need. Coinbase’s x402 protocol, the most widely used agentic payment standard, lets an AI agent pay for online services in stablecoins within seconds, with no account, card or human approval.

To date, the x402 Protocol has reportedly processed approximately 188 million to over 205 million cumulative transactions, with around 69,000 active agents.
Cloudflare, Google, Visa, Mastercard, AWS, Circle and Stripe have joined the x402 Foundation, which the Linux Foundation now governs.

Nate Geraci, co-founder of the ETF Institute, has previously said that AI and crypto are both coming for the traditional banking model.

Key takeaways

• Bitcoin traded below $83,000 on Monday after gaining more than 4% last week.
• Ethereum slipped below $2,700, while XRP consolidated around $1.500.
• BTC remains above its 50-day, 100-day, and 200-day exponential moving averages.

Bitcoin, Ethereum, and XRP began the week on a quieter note after last week’s gains. Bitcoin pulled back below $83,100 on Monday, Ethereum traded below $2,700, and XRP hovered around $1.500. 

The moves suggest traders are reassessing the market’s next direction following its recent advance.

Bitcoin’s technical picture remains constructive despite the dip. The largest cryptocurrency is holding above several closely watched moving averages, while its momentum indicators still lean positive. 

The immediate question is whether buyers can carry BTC back toward $85,000 or whether the pause develops into a deeper pullback.

Bitcoin holds above key moving averages

Bitcoin was trading at $83,100 on Monday after rising more than 4% last week. Its retreat from recent highs has so far left the broader near-term uptrend intact: BTC remains above its 50-day, 100-day and 200-day exponential moving averages (EMAs).

The 50-day EMA stands at $77,323. The 100-day EMA is at $73,931, while the 200-day EMA is at $74,253. 

Together, these levels form a series of potential support areas if selling pressure increases. Holding above them would suggest that the latest dip is a pause within the recent advance.

For now, BTC is trading well above that group of averages. That gives buyers room to absorb a modest pullback, although a drop toward the 50-day EMA would represent a more meaningful test of the rally than Monday’s move below $83,600.

The distinction matters after a strong week. A market can ease from its highs while retaining its upward trend, but repeated failures to recover may gradually weaken buyer confidence. Traders will therefore be watching both how far BTC falls and how quickly demand returns.

Momentum cools as $85,000 caps the upside

Bitcoin’s relative strength index (RSI) was near 61, a reading consistent with positive momentum. It remains below the level commonly associated with overbought conditions, leaving room for another rise if buyers regain control.

The moving average convergence divergence (MACD) indicator has cooled but remains slightly positive. 

That combination points to an uptrend that is still present, though less forceful than during the recent rally. Momentum readings can change quickly, so price action around nearby resistance will offer a clearer test.

The first barrier is approximately $85,000. Bitcoin would need to overcome selling around that level to make a stronger case for extending last week’s gains. A failed attempt could keep BTC in a period of sideways trading as buyers and sellers weigh the recent move.

On the downside, the current price area provides the first place to look for support. A more substantial decline would put the 50-day EMA at $77,323 in focus, followed by the longer-term averages near $74,000. Previously established horizontal support levels at $66,500 and $62,300 sit further below.

These levels outline the range of possible tests rather than a forecast that BTC will reach them. For the near term, the contest is much narrower: whether Bitcoin can stabilize above $83,000 and make another attempt at $85,000.

Ethereum’s move below $2,700 and XRP’s consolidation around $1.500 add to the cautious start to the week. 

Both assets are taking a breather alongside Bitcoin, although the figures provided do not establish equivalent support or resistance levels for either token.

For traders following the three largest cryptocurrencies, Bitcoin’s response to $85,000 may offer a useful gauge of broader market appetite. 

A renewed push above that barrier could signal that buyers remain willing to pursue last week’s gains. Continued consolidation, meanwhile, would leave the market waiting for a clearer direction.

In plain English, puts are relatively pricier than calls, but the relatively richness is barely even noticeable compared to the typical reading of around -4.41 over the past year or so. In other words, puts usually cost a lot more than they do now.

The takeway, therefore, is that bitcoin traders are chasing puts they are not yet positioning for a crash or deep sell-off.

For ether, calls are still more expensive than puts, but the premium has narrowed from a week ago, suggesting that bullish sentiment has cooled.

10x Research also noted an uptick in demand for puts.

“Put demand has jumped over the past few days. The question is whether that is a short-term hedge or the start of a regime shift,” it said on X.

On bitcoin, they still see cheap options, not panic pricing.

“Implied vol is back near cycle lows while realized vol runs 12 points higher, and some Bitcoin options are now priced at 30 vol on a market moving at 42.” Essentially, bitcoin options are still cheap. Stay alert!

Read more: For analysis of today’s activity in altcoins and derivatives, see Crypto Markets Today . For a comprehensive list of events this week, see CoinDesk’s “Crypto Week Ahead.”

MEXC has said it resolved a dispute involving a user who reported losing roughly $340,000 after an attacker allegedly retained API access following an account takeover.

Shuang Fei, the affected user, said 322,110 USDT and 9,133,999 ONE were withdrawn from the account between 04:12 and 04:25 Beijing time on September 27.

MEXC customer support later said the exchange had contacted the user and “successfully reached an agreement.” It described the matter as “fully resolved,” but did not disclose the terms, citing user privacy.

The exchange has not publicly stated whether the user was reimbursed, whether an API key initiated the withdrawals, or what happened to the reported stolen assets.

MEXC account hack began with a security reset

The reported incident began early on September 25 when Shuang Fei received an email stating that an application had been made to change the account’s linked email and remove Google Authenticator.

According to the user’s account, the request arrived at 03:10 Beijing time and was approved 10 minutes later. Shuang Fei said the application was unauthorized and claimed the identification photograph and verification video submitted with it were not genuine materials provided by the account holder.

MEXC later told the user that the materials had initially met its requirements, according to screenshots shared in the thread. During a subsequent review, the exchange detected risk, froze the account and restored the original email address, the user said.

MEXC’s current security reset documentation states that users may be asked to provide account information, identity documents and a video holding their identification when resetting security verification.

Once the attacker controlled the account, Shuang Fei said the password was reset and a new Google Authenticator was linked. Login records shared by the user showed access from an IP address associated with Jakarta, Indonesia.

At 05:05:42, an API was created, according to the user’s account. Shuang Fei said MEXC only disclosed the existence of that API after the funds had already left the account.

Account recovery did not address the reported API

MEXC froze the account at approximately 10:55 on September 25 after its review detected suspicious activity, the user said.

Shuang Fei regained control over the following day by removing the attacker’s Google Authenticator, changing the password and linking a new authenticator. The final change was completed at 03:45:07 on September 26.

MEXC documentation confirms that cryptocurrency and fiat withdrawals are blocked for 24 hours after certain security changes, including modifications to a linked email or Google Authenticator.

A separate MEXC account guide states that freezing an account disables trading and login functions and makes “all API keys associated with your account” invalid.

The user has questioned how the reported API could later have been used if it had become invalid during the account freeze.

“Did this API become invalid at that time?” Shuang Fei asked. The user separately questioned whether it became active again after the account was restored.

MEXC has not publicly answered those technical questions.

$340K left shortly after the withdrawal lock expired

At 04:12:45 on September 27, roughly 27 minutes after the user’s 24-hour withdrawal restriction ended, the first reported outgoing transaction moved 1 USDT.

Five more withdrawals followed within roughly 13 minutes, according to Shuang Fei. The transfers eventually removed 322,110 USDT and 9,133,999 ONE, which the user valued at approximately $340,000.

No fresh login appeared in the account’s login history during those withdrawals, the user claimed.

Security monitoring service CertiK subsequently reported the user’s account of the incident, including the allegation that an attacker-created API remained available and was connected to the withdrawals. CertiK did not independently establish the attack method in its brief notice.

Lookonchain likewise reported the claims and noted that the account showed no new login activity during the withdrawal period.

MEXC completed an initial investigation and offered what it called corresponding solutions, according to an earlier public response reported by BlockBeats. The exchange later said an agreement had been reached with the user.

MEXC API rules allowed withdrawals without a default whitelist

MEXC’s API withdrawal policy provides further context for the user’s questions. In a 2023 announcement, the exchange said withdrawal whitelists would not be enabled by default for API withdrawals, allowing withdrawals to any address unless a whitelist was activated.

The exchange advised API users to enable withdrawal whitelists and avoid disclosing API keys.

Current withdrawal documentation states that normal withdrawals may require email, mobile or Google Authenticator verification, while separate security settings can permit withdrawals under specified conditions without repeated two-factor authentication.

Shuang Fei said the attacker-created API was not visible in the security-operation history available to the user and claimed no notification was received because the account email had already been changed when the API was created.

The user asked MEXC to disclose the IP address used to create the API, its permissions, whether it became invalid while the account was frozen, and which channel initiated the six withdrawals.

The episode follows earlier scrutiny of MEXC’s account controls. In 2025, the exchange returned funds after a separate MEXC $3.15 million frozen-funds dispute involving trader The White Whale.

MEXC has since promoted several user-protection measures, including a planned $500 million Guardian Fund expansion announced in May 2026.

For the current case, MEXC’s public response remains limited. Customer support said the dispute has been resolved and that further details will not be disclosed because of user privacy.